NFPA Journal - May/June 2020 - 50

NFPA 72

Fire alarms, signaling, and
emergency communication

Fire alarms, mass
notification, and
cybersecurity
By Wayne Moore
n recent years, the NFPA
72 Technical Committee
has focused increasingly on cybersecurity.
There have been plenty of
reasons for this attention, among them
the major data breach experienced by
Target stores in 2013. Cyber criminals
were able to exploit a previously unknown
flaw in the retailer's point-of-sale

I

encryption and gained access to Target's
network to syphon off consumer credit
card data. The activity went undetected
for almost a month. More than 41 million
of the company's customer payment card
accounts were affected.
The connection between cybersecurity and NFPA 72®, National Fire
Alarm and Signaling Code®, exists
because all new fire alarm and mass
notification systems (MNS) rely on
computer technology. As a result, these
systems may present similar vulnerabilities to a cyberattack. That's why
the NFPA 72 Technical Committee has
initiated a proposal for a new Chapter
11, Cybersecurity, for the 2022 edition
of the code. The chapter states that
"where cybersecurity is required by a
risk analysis by federal, state, or local
regulation, or by the authority having
jurisdiction, systems shall be in accordance with this chapter."

Although many other fields have
utilized the risk analysis concept,
it remains relatively new to those
involved in the design, installation,
and approval of an MNS. In the 2019
edition of the code, the risk analysis
section in Chapter 24 expanded specifically to include the planning of an
MNS design and installation. The code
defines risk analysis as a process to
"characterize the likelihood, vulnerability, and magnitude of incidents
associated with natural, technological, and manmade disasters and other
emergencies that address scenarios of
concern, their probability, and their
potential consequences."
Additionally, the code helps with
this process by providing a risk analysis checklist in the form of Annex
A.7.3.6. Although the code does not
mandate the use of the checklist,
stakeholders can use it to initiate
the thought process for identifying hazards in a facility. One item
on the checklist, for example, covers
"human-caused intentional events."
This category breaks down further
to "terrorism (explosive, chemical, biological, radiological, nuclear,
cyber)."
It may be last on that list, but cybersecurity has grown exponentially in
importance over the past few years.
Today, cybersecurity issues happen so
fast that the Department of Homeland
Security publishes the Certified
Information Systems Auditor Weekly
Vulnerability Summary Bulletin, which
is created using information from the
NIST National Vulnerability Database.
The Internal Revenue Service recently
launched its "Identity Theft Central"
webpage to provide 24/7 access to
online information regarding tax-related identity theft and data security
protection. Tax-related identity theft
occurs when someone steals personal
information to commit tax fraud.
These problems continue to grow
in their scope and complexity, and
cybersecurity will likely be an active
part of the code for many editions to
come. The proposed new chapter for
NFPA 72 includes sections on standards, compliance, documentation,

GETT Y IMAGES

In Compliance

50 | NFPA JOURNAL * M A Y / J U N E 2 0 2 0

In Compliance_05.20 V2.indd 50

5/2/20 2:19 PM
NFPA Journal - May/June 2020

Table of Contents for the Digital Edition of NFPA Journal - May/June 2020
